FERPA Information for Faculty
What are my Responsibilities?
What are the Consequences of Violations?
Must I Acknowledge my Understanding?
Can I Access Student Records?
How Should I Notify Students of Their Grades?
What Standard Security Practices Must I Follow?
How Should I Return Papers or Exams?
Can I Circulate Attendance Rosters?
Can I Discuss my Students With Other Faculty?
Can I Post my Students’ Email Addresses?
Can I View Records to Write Recommendations?
Understanding FERPA — What Would You Do?
FERPA PowerPoint for Faculty
Release Form for Letters of Recommendation (PDF)
What are my Responsibilities Regarding Student Records?
All university faculty are considered school officials and are required by law to maintain the confidentiality of student records. Any school official who maintains specific records is considered a record custodian. At the University of Florida, the Office of the University Registrar (O.U.R.) is the official custodian for academic records.
The release of any nondirectory information about a student to any person outside the university community or to any university personnel without a legitimate educational interest violates federal and state law, as well as university regulations.
What are the Consequences for Violating FERPA?
Under federal law, FERPA violations may result in the loss of federal funding for UF. Under state law, both UF and you personally may be sued. Any breach of confidentiality could lead to disciplinary action, including the possibility of termination of employment.
Must I Formally Acknowledge That I Understand FERPA?
All O.U.R. employees who work with student records must sign the Confidentiality of Student Records statement. This document explains that academic records may only be disclosed to or discussed with individuals with legitimate educational interest. After signing this statement, it becomes part of the employee's file.
All UF offices should consider developing a procedure for handling confidential academic records and ensuring that all staff are educated in these procedures. In addition, we strongly encourage you to require staff to acknowledge their understanding of such protocol in writing.
Can I Access Student Academic Records?
Faculty must have a legitimate educational interest in order to access a student's academic record.
What are Appropriate Ways to Notify Students of Their Grades?
- Please assign or allow students to choose a unique and confidential identifier (e.g.,
a 4-digit number). This unique identifier cannot be part of the student's name, UFID or social security number. - Grade lists must be posted in random, not alphabetical order.
- Web-based course management systems such as WebCT can be used to post grades if the system is secured by username and password. For assistance with WebCT grade posting, please contact the Office of Academic Technology (1012 Turlington Hall; 352-392-0371).
- The Office of the University Registrar does not send grades by email because there is no guarantee of confidentiality with electronic transmission.
- You can send grades via fax or by telephone only if you are certain that the student is the one receiving the information. To verify the student's identity, you should confirm personally identifiable information with the student.
- You may also mail students their final grades. Have students provide self-addressed, stamped envelopes. You may not send grade notification using a postcard.
What Standard Security Practices Must I Follow?
All faculty must utilize reasonable measures to preserve the confidentiality, security and integrity of University of Florida information systems and the information contained therein. All teaching staff should practice appropriate security measures:
- Never disclose, share or loan your username(s) and password(s) to anyone (e.g., another employee, faculty member, supervisor, student assistant, etc.). Department staff or supervising faculty should obtain individual log-on information for graduate/teaching assistants. Security access for the student records system is available from the O.U.R.
- Never use generic/group IDs when accessing confidential academic record information.
- Ensure that remote access to, retrieval and transmission of confidential academic record information is accomplished through a secure and encrypted connection (e.g., HTTPS, SSH or SSL).
In addition, faculty should take reasonable measures to restrict unauthorized persons from viewing confidential academic record information. For example, you should:
- Never leave your computer workstation unattended while signed on without appropriate screen locking (e.g., a password-protected screen saver).
- Never leave personal logon information (e.g., username, password, network mapping, etc.) in view of unauthorized persons.
- Never program (or ‘hot-key’) automatic access to confidential academic record systems.
What are Acceptable Methods for Returning Papers or Exams?
You may share graded papers and exams only with the student, with others upon receiving the student's consent or with university officials in performance of official duties. Student papers or exams should not be left outside an office door where students must look through all the papers to find their own; students should not have access to other students' grades. While you may return papers and/or examinations by mail, the safest practice is to return papers personally to the student.
Can I Circulate a Class Attendance Roster?
You can circulate an attendance roster, but it should not contain confidential information such as social security number, UFID number and/or grades.
Can I Discuss my Students With Other Faculty?
Faculty should discuss a student’s academic record only with that student or with university employees in the performance of official duties.
Can I Post my Students’ Email Addresses?
Faculty who utilize electronic teaching tools such as WebCT or Blackboard may wish to share students' email addresses or other personally identifiable information with others in the same class. This is permissible as long as students have an opportunity to decline. No information should be posted or disclosed for students with privacy holds.
Am I Required to Obtain a Release Prior to Writing a Letter of Recommendation for a Student?
It depends. In general, a written release is recommended, not required, for letters sent to other educational institutions to which the student is applying and to professional
school admission services. The release is required, however, when the recommendation is sent to an employer or to an individual for another purpose.
(A release form is provided for your use; refer to the PDF at top of this page.)
Faculty may include information from personal observation or knowledge without the student's consent, but it is not acceptable for faculty to access a student's record to view grades/information from other classes and terms. If the recommendation will include nondirectory/personally identifiable information (grades, GPA, etc.) obtained from the student’s academic record, you should obtain a signed release from the student. Releases should specify the information that may be disclosed, the identity of the party(ies) to whom the disclosure can be made, the student's signature and the date.
Understanding FERPA – What Would You Do?
- You are a physics professor assigning semester grades. You are undecided about the grade to give one of your students and you’d like to look at his grade in another class.
This does not qualify as legitimate educational interest. Faculty cannot review a student’s previous academic history before assigning a final grade.
- A parent calls and wants to know if her son has been attending your class regularly. Your response is:
If you keep attendance records, check with the O.U.R. to determine whether the parent has provided the student's written consent or appropriate IRS documentation indicating the student's dependency status. If so, you may release the information; if not, refer the parent to the administrative area of the O.U.R.
- A colleague in your department tells you that she suspects that one of her students has cheated on an exam and asks you about this student's performance in your class last semester. Under FERPA, what is an appropriate response?
You should not discuss the progress or performance of a student with anyone, including parents and other faculty, without the student's consent. Inquiries to faculty regarding previous student performance do not constitute a legitimate educational interest. In this case, you can contact Student Judicial Affairs (202 Peabody Hall; 352-392-1261, ext. 207) to determine if the student has a prior academic honesty violation.
- If I receive a request to release a list of students enrolled in my class, should I do it?
You should not provide anyone with lists of students enrolled in your class(es) for any commercial purpose. Such requests should be forwarded to the Office of University Registrar for review and response.
These pages contain questions and information that address situations commonly faced by:
Students
Parents
Staff
Glossary of Terms
Take the FERPA Beginner's Tutorial
Take the FERPA Intermediate Tutorial
Take the FERPA Advanced Tutorial